Logstash 7.9.2 service will not start on Ubuntu 18.04

Elastic Stack Logstash
1

Hello,

I have a new installation on Ubuntu 18.04 where I have successfully installed "elasticsearch and kibana". However, after installing logstach and attempting to start it, it continues to fail with the following messages in the syslog:

Has anyone seen these error before that can provide some ideas on how to solve it.

Thanks!

------------ syslog messages below -------------------------------------
Sep 29 00:29:26 logsrvr systemd[1]: Started logstash.
Sep 29 00:29:26 logsrvr logstash[1860]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
Sep 29 00:30:04 logsrvr logstash[1860]: WARNING: An illegal reflective access operation has occurred
Sep 29 00:30:04 logsrvr logstash[1860]: WARNING: Illegal reflective access by org.jruby.ext.openssl.SecurityHelper (file:/tmp/jruby-1860/jruby2010222270485342373jopenssl.jar) to field java.security.MessageDigest.provider
Sep 29 00:30:04 logsrvr logstash[1860]: WARNING: Please consider reporting this to the maintainers of org.jruby.ext.openssl.SecurityHelper
Sep 29 00:30:04 logsrvr logstash[1860]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
Sep 29 00:30:04 logsrvr logstash[1860]: WARNING: All illegal access operations will be denied in a future release
Sep 29 00:30:07 logsrvr logstash[1860]: Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
Sep 29 00:30:08 logsrvr logstash[1860]: [2020-09-29T00:30:08,613][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.9.2", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc OpenJDK 64-Bit Server VM 11.0.8+10-post-Ubuntu-0ubuntu118.04.1 on 11.0.8+10-post-Ubuntu-0ubuntu118.04.1 +indy +jit [linux-x86_64]"}
Sep 29 00:30:11 logsrvr logstash[1860]: [2020-09-29T00:30:11,423][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>"/etc/logstash/conf.d/*.conf"}
Sep 29 00:30:11 logsrvr logstash[1860]: [2020-09-29T00:30:11,488][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
Sep 29 00:30:12 logsrvr logstash[1860]: [2020-09-29T00:30:12,277][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
Sep 29 00:30:17 logsrvr logstash[1860]: [2020-09-29T00:30:17,102][INFO ][logstash.runner          ] Logstash shut down.
Sep 29 00:30:17 logsrvr logstash[1860]: [2020-09-29T00:30:17,180][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
Sep 29 00:30:17 logsrvr systemd[1]: logstash.service: Main process exited, code=exited, status=1/FAILURE
Sep 29 00:30:17 logsrvr systemd[1]: logstash.service: Failed with result 'exit-code'.
Sep 29 00:30:17 logsrvr systemd[1]: logstash.service: Service hold-off time over, scheduling restart.
Sep 29 00:30:17 logsrvr systemd[1]: logstash.service: Scheduled restart job, restart counter is at 2.
Sep 29 00:30:17 logsrvr systemd[1]: Stopped logstash.
2

Welcome to our community! :smiley:

Did you configure anything after the install?

3

Actually, no I was trying to make sure the service started correctly before moving to configure any connection. I would have thought that the service would at least start after the installation using default config just like the other two installations I mentioned worked fine. The documentation did not indicate that anything had to be configured after the installation.

Is this configuration required before initially starting the service?

Thanks

4

Yes, otherwise it's got nothing to run with.

5

Thanks, I'll try to configure the file and see what happens.

Looks like the documentation needs to be updated because if you follow the installation instructions, you get the impression that the service should be running -- it's not clear at all.

I appreciate the information.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.